# Filippo Valsorda Published articles for Filippo Valsorda. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Production ML-DSA Verification in 350 Lines of Python DevFeed: [Production ML-DSA Verification in 350 Lines of Python]() Original publisher: [Read original article]() Author: Filippo Valsorda Published: 2026-07-26T11:45:08Z Content type: article Language: en Sources: [Filippo Valsorda]() Topics: [Post-Quantum](), [Python](), [Cryptography](), [Testing](), [mutation-testing]() Tags: [cryptography](), [mutation-testing](), [post-quantum](), [python](), [testing](), [verification]() ### AI overview The article presents a production pure-Python ML-DSA signature verifier that supports all parameter sets, Python 3.8 and later, and an API modeled after pyca/cryptography. It describes the implementation's performance, portability rationale, and testing with Wycheproof vectors, accumulated vectors, pytest, mutation testing, and branch coverage. ### Source excerpt I am publishing a production, pure-Python ML-DSA verifier. It's just 350 lines, and pretty readable and robust. ## Opaque, Interoperable Passkey Records (and a Go API) DevFeed: [Opaque, Interoperable Passkey Records (and a Go API)]() Original publisher: [Read original article]() Author: Filippo Valsorda Published: 2026-07-20T22:33:32Z Content type: article Language: en Sources: [Filippo Valsorda]() Topics: [WebAuthn](), [Passkeys](), [Go Language](), [Security](), [API](), [passwords]() Tags: [api](), [authentication](), [go](), [password](), [security](), [web](), [web-developers]() ### AI overview The article proposes interoperable passkey record encodings for WebAuthn credentials, allowing applications to store records as opaque strings similar to password hashes. It also presents a potential Go API for handling these records. ### Source excerpt Passkey records are an interoperable format for WebAuthn credentials, similar to password hash strings. I propose a potential crypto/passkey Go API based on them. ## Vulnerability Reports Are Not Special Anymore DevFeed: [Vulnerability Reports Are Not Special Anymore]() Original publisher: [Read original article]() Author: Filippo Valsorda Published: 2026-06-23T13:00:00Z Content type: opinion Language: en Sources: [Filippo Valsorda]() Topics: [vulnerability](), [Large Language Model](), [Maintainers](), [Security](), [Open Source]() Tags: [llm](), [maintainers](), [open-source](), [reports](), [security](), [vulnerability]() ### AI overview This commentary argues that vulnerability reports may no longer warrant special treatment because LLMs make security insight widely available. It says the main bottleneck has shifted from discovering potential issues to determining which reports are real, while confidentiality and coordination may be less important than before. ### Source excerpt We needed the insight and confidentiality to protect our users, but now that anyone can get the same results from LLM? ## Quantum Computers Are Not a Threat to 128-bit Symmetric Keys DevFeed: [Quantum Computers Are Not a Threat to 128-bit Symmetric Keys]() Original publisher: [Read original article]() Author: Filippo Valsorda Published: 2026-04-20T15:21:12Z Content type: article Language: en Sources: [Filippo Valsorda]() Topics: [Post-Quantum](), [Cryptography](), [Algorithms, Complexity](), [Security]() Tags: [algorithm](), [algorithms](), [cryptography](), [post-quantum](), [quantum](), [quantum-algorithms](), [security]() ### AI overview The article argues that quantum computers do not require larger symmetric key sizes during the post-quantum transition. It explains why Grover's algorithm does not reduce the practical security of AES-128 and SHA-256 enough to justify replacing 128-bit symmetric keys, while asymmetric cryptography remains affected by Shor's algorithm. ### Source excerpt There is no need to update symmetric key sizes as part of the post-quantum transition, due to the details of how Grover's algorithm scales. Most authorities agree. ## A Cryptography Engineer's Perspective on Quantum Computing Timelines DevFeed: [A Cryptography Engineer's Perspective on Quantum Computing Timelines]() Original publisher: [Read original article]() Author: Filippo Valsorda Published: 2026-04-06T15:00:00Z Content type: opinion Language: en Sources: [Filippo Valsorda]() Topics: [Quantum Computing](), [Cryptography](), [Post-Quantum](), [Security, Privacy and Abuse Prevention]() Tags: [attacks](), [cryptography](), [hardware](), [post-quantum](), [quantum](), [quantum-computing](), [research]() ### AI overview A cryptography engineer explains why recent research on quantum algorithms, hardware, qubits, and error correction has changed his assessment of the urgency of migrating to quantum-resistant cryptography. He argues that cryptographically relevant quantum computers may arrive within the next few years and could threaten elliptic-curve cryptography and WebPKI. ### Source excerpt The risk that cryptographically-relevant quantum computers materialize within the next few years is now high enough to be dispositive, unfortunately. ## Turn Dependabot Off DevFeed: [Turn Dependabot Off]() Original publisher: [Read original article]() Author: Filippo Valsorda Published: 2026-02-20T19:48:08Z Content type: opinion Language: en Sources: [Filippo Valsorda]() Topics: [GitHub Actions](), [Go Language](), [Vulnerabilities](), [ci]() Tags: [ci](), [dependabot](), [github-actions](), [go](), [security](), [vulnerabilities](), [vulnerability-scanner]() ### AI overview The article argues that Dependabot creates excessive and often irrelevant security-alert noise in the Go ecosystem. It recommends replacing Dependabot with scheduled GitHub Actions that run govulncheck and tests against the latest dependency versions, and using vulnerability scanners that filter by package and vulnerable-symbol reachability. ### Source excerpt I recommend turning Dependabot off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies. ## Inspecting the Source of Go Modules DevFeed: [Inspecting the Source of Go Modules]() Original publisher: [Read original article]() Author: Filippo Valsorda Published: 2026-02-12T13:48:03Z Content type: article Language: en Sources: [Filippo Valsorda]() Topics: [Go Language](), [modules](), [integrity](), [Security](), [GitHub](), [Code]() Tags: [cryptographic](), [github](), [go](), [integrity](), [modules](), [security](), [tooling](), [transparency-log](), [verification](), [verify]() ### AI overview The article explains how the Go Checksum Database verifies module source and helps protect against altered tags and targeted versions. It argues that viewing code directly on GitHub can bypass this verification, using a malicious BoltDB module incident as an example, and recommends fetching source with Go tooling for review. ### Source excerpt Code hosts like GitHub don't necessarily show the correct source of Go modules. pkg.geomys.dev is a new convenient viewer for module source. ## go.sum Is Not a Lockfile DevFeed: [go.sum Is Not a Lockfile]() Original publisher: [Read original article]() Author: Filippo Valsorda Published: 2026-01-05T20:06:30Z Content type: article Language: en Sources: [Filippo Valsorda]() Topics: [Go Language](), [modules](), [Security](), [supply chain attacks]() Tags: [dependencies](), [go](), [golang](), [modules](), [security](), [supply-chain-attacks]() ### AI overview The article explains that Go's go.sum is a local cache of cryptographic hashes for the Go Checksum Database, not a lockfile and not part of version resolution. It contrasts go.sum with go.mod, which lists the precise dependency versions used to build the main module and its tests. ### Source excerpt In Go, go.mod acts as both manifest and lockfile. There is never a reason to look at go.sum. ## Building a Transparent Keyserver DevFeed: [Building a Transparent Keyserver]() Original publisher: [Read original article]() Author: Filippo Valsorda Published: 2025-12-19T14:03:18Z Content type: tutorial Language: en Sources: [Filippo Valsorda]() Topics: [systems](), [rate-limiting](), [Go Language](), [Server](), [SQLite](), [Authentication](), [Tooling](), [Command-line interface]() Tags: [api](), [authentication](), [building](), [cli](), [go](), [privacy](), [rate-limiting](), [server](), [sqlite](), [tooling](), [transparency-log]() ### AI overview This tutorial builds a centralized keyserver for looking up age public keys. It applies transparency-log technology to help keep the operator accountable and prevent surreptitious injection of malicious keys while protecting user privacy. The implementation uses a Go server, SQLite database, APIs, email authentication, a CAPTCHA, and a Go CLI. ### Source excerpt We apply a transparency log to a centralized keyserver step-by-step, in less than 500 lines, with privacy protections, anti-poisoning, and witness cosigning. ## The 2025 Go Cryptography State of the Union DevFeed: [The 2025 Go Cryptography State of the Union]() Original publisher: [Read original article]() Author: Filippo Valsorda Published: 2025-11-20T15:42:24Z Content type: article Language: en Sources: [Filippo Valsorda]() Topics: [Go Language](), [Cryptography](), [Security](), [Post-Quantum](), [TLS (Transport Layer Security)](), [OpenSSH]() Tags: [2025](), [cryptography](), [encryption](), [go](), [post-quantum](), [security](), [ssh](), [tls]() ### AI overview A transcript of the 2025 Go Cryptography State of the Union, covering developments in Go cryptography over the previous year. It highlights post-quantum key exchanges, FIPS 140 work, and the security track record of Go cryptography packages, including vulnerability trends. ### Source excerpt I delivered my traditional Go Cryptography State of the Union talk at GopherCon US 2025 in New York. It goes into everything that happened at the intersection of Go and cryptography over the last year.